SLDR: Defending Against Malicious Fine-tuning via Selective Layers Recovery and Dynamic Routing
SLDR restores LLM refusal after malicious fine-tuning by recovering sensitive layers and routing only harmful queries.
Malicious fine-tuning can erode aligned LLM refusal while preserving performance on legitimate tasks. SLDR trains a LoRA recovery adapter only on layers with the maximum and minimum signed safety-sensitivity scores, then uses representation-based dynamic routing so the adapter activates only for malicious queries. Across four architectures, five downstream tasks, and four harmful benchmarks it reduces harmful outputs while keeping downstream utility. On Llama 3.1 with SST-2, the average harmful score drops from 11.54 to 0.08 and remains near zero at poisoning ratios up to 0.9.
- Signed layer sensitivity can strengthen, weaken, or barely change refusal
- LoRA recovery covers only the max- and min-sensitivity layers
- Dynamic routing activates the adapter only for malicious queries
- Llama 3.1/SST-2 harmful score falls from 11.54 to 0.08
- Score stays near zero at poisoning ratios up to 0.9
Full article160 words · extracted from arxiv.org · click to collapse
Fine-tuning-as-a-service enables users to adapt aligned large language models (LLMs) to specialized tasks, but malicious fine-tuning can erode refusal behavior while preserving task performance on legitimate inputs. We revisit recent layer-wise safety diagnostics and find that safety sensitivity is signed: scaling different layers can strengthen refusal, weaken it, or have little effect. Motivated by this observation, we propose SLDR, a post-fine-tuning defense based on Selective Layers Recovery and Dynamic Routing. SLDR trains a LoRA recovery adapter only on the layers with the maximum and minimum sensitivity scores in the signed spectrum, and uses representation-based dynamic routing inference to activate the adapter only for malicious queries. Across four model architectures, five downstream tasks, and four harmful benchmarks, SLDR substantially reduces harmful outputs while preserving downstream utility. On Llama3.1/SST2, SLDR reduces the average harmful score from 11.54 to 0.08 while maintaining downstream accuracy, and the harmful score remains near zero under poisoning ratios up to 0.9. The code is available at https://github.com/Stardust457/SLDR.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.10345